Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zimbra/zm-mailbox

              develop @ f9529df
            

433

Fixes

CVEs

CRITICAL

Peak severity

18.9%

Coverage

Highlights

Auth Bypass: 195 prior fixes. Scrutinize any change in this area.

src/java/com/zimbra/cs/account/ldap/LdapProvisioning.java: most-fixed (8 issues). Treat as high-risk during review.

334 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Dominant vulnerability class with 195 fixes, showing systemic gaps in authorization checks across SOAP/admin and delegated operations. Many fixes are one-off patches to specific handlers, indicating a missing centralized check.

CSRF: 32+ fixes around CSRF validation, token placement, and filter mappings. Recurring bypasses via missing token in header, fallback to body, and inconsistent enforcement across upload/SOAP/admin paths.

XXE: Multiple XML parsing paths were vulnerable to XXE, with fixes disabling DTDs/external entities individually, indicating a lack of a shared secure-parser utility. SOAP, SAML, and attribute parsing all touched.